Release v2.8.0: lifecycle hardening and official mirror

.github/CODEOWNERS

@@ -1,3 +1,5 @@
+# Ownership metadata only; the single-maintainer ruleset does not require a
+# CODEOWNERS approval.
 # Default owner for everything in the repo.
 *                                   @xxvcc
 

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: ci
     groups:
@@ -19,6 +21,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: build
     groups:

.github/workflows/codeql.yml

@@ -14,13 +14,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
+    name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       security-events: write # upload results to the Security tab
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.26.x'

.github/workflows/go.yml

@@ -2,20 +2,30 @@ name: Go
 
 on:
   push:
+    branches: [main]
   pull_request:
 
 permissions:
   contents: read
 
+concurrency:
+  group: go-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-test:
+    name: Build and test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.26.x'
           check-latest: true
+      - name: Mirror receiver policy tests
+        run: python3 -B -m unittest -v scripts/mirror_receiver_test.py
       - name: Vet
         # -printf.funcs also checks our concatenating log helpers (printf/errorf/warnf)
         run: go vet -printf.funcs=printf,errorf,warnf ./...
@@ -29,9 +39,12 @@ jobs:
           fi
 
   integration:
+    name: Root integration
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.26.x'
@@ -40,12 +53,15 @@ jobs:
         run: sudo -E env "PATH=$PATH" go test -race -tags integration ./...
 
   static-cross-build:
+    name: Static cross-build (${{ matrix.goarch }})
     runs-on: ubuntu-latest
     strategy:
       matrix:
         goarch: [amd64, arm64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.26.x'
@@ -58,9 +74,12 @@ jobs:
         run: go build -tags osusergo,netgo -ldflags '-s -w' -o /dev/null ./cmd/linux-temp-admin
 
   govulncheck:
+    name: Vulnerability scan
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.26.x'
@@ -71,5 +90,5 @@ jobs:
         # 1.26.x, while go.mod pins the current security floor) or by an explicit,
         # documented suppression.
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
           "$(go env GOPATH)/bin/govulncheck" ./...